I have some concerns about security and am wondering how AWS will store an SSL certificate deployed to an ELB. I have a wildcard SSL cert for my domain that I want to make sure doesn't persist anywhere where I don't know the steps taken to secure it.

I'm trying to set up a really simple image server on AWS that serves over HTTPS. What I've done is create an nginx server on a T2-micro that proxies to an S3 bucket with my images and put it behind an ELB. Where does that certificate ultimately persist if I put it on the ELB?

As a sidenote, does AWS actually support SSL offloading to the instance an ELB points to? I found hints this is possible in some documentation but couldn't find anything else past that hint.

  • 2
    You can use TCP instead of HTTP load balancing with ELBs to have your servers handle SSL termination. I'm not aware of AWS having made public much about how ELBs are set up, but it is probably a safe assumption that Amazon is better at security than you or I could be. If you've got an audit to answer, aws.amazon.com/compliance is a good spot to start. – ceejayoz Jun 20 '16 at 18:26

Where does that certificate ultimately persist if I put it on the ELB?

The certificates are stored in IAM.

They should be as secure, there, as your account credentials are, so this seems like a misplaced concern, to me, once you have this information.

The ELB instances fetch the cert, chain, and private key from IAM whenever they start up or scale up.

Note, of course, that securing your "certificate" is a silly concept. Your certificate, and the chain, are public. They are dutifully handed over to ever web browser that makes a connection. That's how SSL works. The part that needs to be secured is, of course, the private key. Without that, your cert can't be abused.

And IAM secures this. So much so, that not even you can get it back once you've stored it.

If you decided, for whatever reason, that you wanted to fetch your cert and its private key from IAM... well, you can't.

You can list them, overwrite them, and delete them from the IAM database, but not even the account owner can retrieve then. They're secured.

Arguably, on your instances, the accompanying private key would be less secure... but...

You can let ELB balance TCP connections to instances that are handling SSL for themselves, by simply configuring the ELB listener in TCP mode, rather than HTTP.

Of course this puts more work on your instances, and it isn't called "offloading" -- the terminology is reversed -- this configuration would be "not offloading." Offloading would be the normal mode -- an ELB in SSL mode is doing SSL offloading for the instance -- handling SSL instead of the instances, themselves, handling their own SSL.

  • 1
    Excellent answer. IIRC an additional downside of TCP mode is lack of X-Forwarded-For headers and less useful health checking. – ceejayoz Jun 20 '16 at 18:48
  • 1
    Thanks, and good points... although enabling ELB support for the proxy protocol allows the Proxy protocol allows you to identify the source IP address and port, if the inside machines know how to interpret it (HAProxy, Nginx, maybe others). For full-stack health checks, you might want a health check agent if some kind (more moving parts), or the instance's listening daemon would need to deliberately fail itself if it was unhealthy, to be sure the ELB was aware of its true status. – Michael - sqlbot Jun 20 '16 at 19:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.